Present single-use password setup handoff

tests/test_provisioning_adapter.py

@@ -20,6 +20,7 @@ class ProvisioningAdapterTests(unittest.TestCase):
             "external_subject": "person-1",
             "status": "password_setup_required",
             "resumed": True,
+            "password_setup_url": "https://kc.example/setup/password?token=opaque",
         }).encode())
         adapter = HTTPIdentityProvisioningAdapter(
             base_url="http://provisioner", bearer_token="secret\n"
@@ -33,6 +34,10 @@ class ProvisioningAdapterTests(unittest.TestCase):
             correlation_id="corr-1",
         ))
         self.assertTrue(result.resumed)
+        self.assertEqual(
+            "https://kc.example/setup/password?token=opaque",
+            result.password_setup_url,
+        )
         request = opener.call_args.args[0]
         self.assertEqual("Bearer secret", request.headers["Authorization"])
         self.assertIn(b"idem-1234567890123456", request.data)

tests/test_web.py

@@ -187,6 +187,17 @@ class PortalApplicationTests(unittest.TestCase):
         self.assertEqual("200 OK", page["status"])
         self.assertIn(b"ada@example.test", html)
         self.assertIn(b"Create login", html)
+        user_id = next(iter(self.app.service.store.users))
+        handoff, html = invoke(
+            self.app,
+            f"/admin/tenant:friendly:binky/users/{user_id}/provision",
+            method="POST",
+            cookie="ue_session=browser",
+            form={"csrf_token": "csrf-test-token"},
+        )
+        self.assertEqual("200 OK", handoff["status"])
+        self.assertIn(b"Continue to password setup", html)
+        self.assertIn(b"https://kc.example/setup/password?token=opaque", html)
 
 
 class FakeProvisioning:
@@ -199,6 +210,7 @@ class FakeProvisioning:
             provider="netkingdom-lldap",
             external_subject=request.primary_email.split("@")[0],
             status="password_setup_required",
+            password_setup_url="https://kc.example/setup/password?token=opaque",
         )
 
     def suspend(self, *, external_subject, idempotency_key, correlation_id):